News for hackers. Stuff that matters.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by fixermark on Tuesday November 28, 2017 @03:40PM (#15801290)
Is it likely it's just an error due to the discoverer not being immersed in the Infosec space? "Don't disclose a 0-day publicly" is good 'common' sense, but only among the 'common' of people who are steeped in security issues and the ramifications of publicizing them.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by mikeash on Tuesday November 28, 2017 @03:44PM (#15801345)
Indeed, discovering this bug wouldn't take any security skill (I imagine it could be harmful since you might skip really dumb stuff like this) and could easily happen by accident. Responsible disclosure is standard for security researchers but I don't think this person was one, and it's not very fair to blame him for not doing it right.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by lawnchair_larry on Tuesday November 28, 2017 @04:38PM (#15802046)
That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by mwfunk on Tuesday November 28, 2017 @05:59PM (#15802747)
Google Project Zero does not support full public disclosure immediately- quite the opposite. They support full public disclosure after giving the vendor an opportunity to ship a fix to their customers in a reasonable period of time. Nobody's debating whether or not security flaws should be publicly disclosed- of course they should. The only debate is, what is the most responsible way to handle such a security issue such that it harms the fewest users.

Project Zero (and infosec professionals, at least all of the ones I've ever worked with) would tell you that this was the most irresponsible way to handle the issue, short of not saying anything and selling knowledge of the exploit to someone other than the vendor who could fix it. Publicizing something like this in this way is something people do because they want publicity for themselves. It is not something someone does if their biggest concern is for the users who might be affected by it. It is something someone would do if they didn't care about the users, and just wanted public credit for pointing it out.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by lawnchair_larry on Thursday December 07, 2017 @03:50PM (#15874044)
You added the word "immediately", making that a straw man. I did not say they disclose immediately. Their policy is still full disclosure, including working proof-of-concept exploit code, even when the vulnerability is unpatchable and millions are affected. Ask Microsoft and Apple about the times they went beyond 90 days.

Furthermore, that deadline is 7 days if they are aware of active exploitation.

DJB is famous for his full disclosure with no advanced warning stance.

The rest of your post is false. That is your opinion, and people disagree. I'm going to guess you have not personally spoken with folks from project zero. I have spoken with some of them. And trust me, they would not agree with your statement. A few of them even feel strongly that their timelines are far too generous. I also understand their reasoning, and it has nothing to do with ego or publicity, and everything to do with concern for users.

They do not give a shit about credit beyond believing that it is proper to cite the authors of any work. That isn't the case for everyone finding bugs, but people on that team lost the novelty of having their name on bug reports long ago.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by Veen on Tuesday November 28, 2017 @04:45PM (#15802118)
Project Zero does full disclosure 90 days after informing the relevant organization. Full disclosure comes after there has been a chance to fix the problem. Otherwise everyone is put at risk until a fix is available.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by albertTJames on Wednesday November 29, 2017 @04:27PM (#15811020)
Which respected professionals ? This is completely false.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by lawnchair_larry on Thursday December 07, 2017 @03:40PM (#15873929)
No, it isn't. DJB is an easy one. I won't name others, but I know, and know of, many.